Description
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.
Published: 2026-10-24
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Weak password recovery potentially enabling unauthorized access
Action: Patch Update
AI Analysis

Impact

A flaw in the password‑recovery routine of FaveoHelpDesk 2.0.3 allows an attacker to trigger a weak reset process via the ForgotPasswordController::sendResetLinkEmail method. The weakness results in a reset path that is not sufficiently protected, enabling unauthorized password resets and potential account takeover. The vulnerability is a classic case of poor password‑reset policy (CWE‑640).

Affected Systems

The affected product is FaveoSuite Faveo Helpdesk version 2.0.3. No other versions or vendors are listed. Administrators should verify that the instance is running this specific version and take action accordingly.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, so current exploitation probability is unknown. The issue is not in the CISA KEV catalog. The flaw can be triggered remotely through the password‑reset functionality exposed by the web application. Given the remote vector and moderate score, attackers with an awareness of the web interface could abuse the weak reset to gain account access.

Generated by OpenCVE AI on October 24, 2026 at 19:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑released patch that fixes the weak password recovery in FaveoHelpDesk 2.0.3.
  • If the patch is not yet released, temporarily disable or restrict the password‑reset functionality and enforce strong password policies.
  • Enable multi‑factor authentication for all user accounts to mitigate potential account takeover and monitor for unusual password‑reset activity.

Generated by OpenCVE AI on October 24, 2026 at 19:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 24 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.
Title FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery
First Time appeared Faveosuite
Faveosuite faveo Helpdesk
Weaknesses CWE-640
CPEs cpe:2.3:a:faveosuite:faveo_helpdesk:*:*:*:*:*:*:*:*
Vendors & Products Faveosuite
Faveosuite faveo Helpdesk
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Faveosuite Faveo Helpdesk
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-24T18:15:15.067Z

Reserved: 2026-10-24T00:52:48.359Z

Link: CVE-2026-115973

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-24T19:17:04.553

Modified: 2026-10-24T19:17:04.697

Link: CVE-2026-115973

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T19:30:07Z

Weaknesses
  • CWE-640

    Weak Password Recovery Mechanism for Forgotten Password